1
2015 Compliance Institute April 19, 2015
FDR Oversight:
How Do You Do It All
(Or Not)?
Personalize. Empower. Improve.
Medica’s Vendor Oversight Program
Yvonne Bloom
Director, Corporate Compliance and Privacy
3
Introduction
Who is Medica?
CMS Requirements - What is an FDR?
- FDR Oversight Requirements - Training Details and Changes
Medica’s Oversight Program - Contracting Process
- Identifying FDRs
- Ongoing Auditing and Monitoring - Vendor Oversight Committee
Resources
Who is Medica?
Founded in 1975
Headquartered in Minnetonka, Minnesota
Provides health coverage to 1.5 million members
Provider network includes 27,000 providers at more than 4,000 offices, clinics and hospitals in
Minnesota, Wisconsin, North Dakota and South Dakota.
5
CMS Requirements
6
What is an FDR?
Section Title -
First Tier Any party that enters into a written
agreement, acceptable to CMS, with a Medicare Advantage Organization (MAO) or Part D sponsor or applicant to provide administrative or health care services to a Medicare eligible individual under the Medicare Advantage (MA) or Part D program.
Downstream Any party that enters into an acceptable written arrangement below the level of the arrangement between an MAO or Part D sponsor and a first tier entity. These written arrangements continue down to the level of the ultimate provider of both health and administrative services
Related Entity Any entity that is related to an MAO or Part D sponsor by common ownership or control and: performs some of the MAO or Part D sponsor’s management functions under contract or delegation; furnishes services to Medicare enrollees under an oral or written agreement; or leases real property or sells materials to MAO or Part D plan sponsor at a cost of more than $2,500 during a contract period.
7
Common FDR Examples
• Pharmacies
• Pharmacy Benefit Managers (PBMs)
• Network Providers
• Provider Credentialing Services
• Claims Processing Entities
• Fulfillment Vendors
• Sales and Marketing Agents
FDR Oversight Requirements
Accountability resides with the Sponsor for any functions or responsibilities delegated to an FDR
• Appropriately identify FDRs
• Provide FDRs general compliance and fraud, waste & abuse training (at the time of contract and annually
thereafter)
• Monitor and audit FDR compliance with Medicare program requirements
9
Who Needs Training?
• CMS has a Standardized Training and Education Module for both general compliance training and FWA
• FDRs subject to this training requirement must take both training modules.
• FDRs that meet the FWA certification requirement through enrollment into Parts A or B of the Medicare program or through accreditation as a supplier of DMEPOS are deemed to have met the FWA training requirement. However, they must still complete the general compliance training module.
10
Training Details
• In addition to providing training to the FDR, the Sponsor must be able to demonstrate FDRs have fulfilled the training requirements
• 3 Current mechanisms to provide training
• Sponsor provides training directly to the FDRs (live and in person using CMS training)
• Sponsor provides training material to FDRs (link to CMS training)
• FDRs complete the CMS Standardized training available on the CMS Medicare Learning Network (MLN)
11
2016 Training Changes
• Beginning on January 1, 2016, FDRs are required to take the CMS compliance and FWA training module on the CMS website
• Sponsors can put a link to the CMS training on their website
• Deemed FDRs must still complete the general
compliance training module, but are exempt from FWA training via certification or enrollment in Part A or B
• Sponsors are required to accept the certificate of completion of the CMS compliance and FWA training as satisfaction of this requirement
Medica’s
Vendor Oversight Program
13
Company Structure
Medicare Compliance & Contract Leads
Corporate Compliance & Vendor Oversight
Internal Audit completes auditing & monitoring
14
Vendor Oversight Workflow
Contract entered into Contract System by
Business Unit
Medicare Compliance identifies FDR status
Vendor Oversight ensures initial FDR specific requirements are met
Vendor Oversight and Medicare Compliance manage annual FDR auditing and monitoring Internal Audit conducts
audit on FDR processes Vendor Oversight Committee reviews processes, auditing and
prompts escalation to Compliance Officer
15
The Contracting Process
• Medica uses a Contract Relationship Management (CRM) system for contract tracking
• Business Owners initiate the contract and manage the day-to-day relationship with vendors
• Contract Leads understand the contracting policies and are accountable for the accuracy and
completeness of the information in CRM
• Contract Leads receive both initial training and ongoing quarterly training on the CRM system and contract policies
Contract Management Hierarchy
Corporate Compliance Officer
Contract Lead Business Unit 1
Business Owner
Business Owner
Contract Lead Business Unit 2
Business Owner
Business Owner
Contract Lead Business Unit 3
Business Owner
Business Owner Vendor
Oversight Manager
17
Contract Considerations
• Provision of general compliance and fraud, waste & abuse training
• Inclusion of a Regulatory Addendum
• Obtaining a Disclosure of Ownership to execute excluded entity sanction checks
• Inclusion of a Business Associate Addendum for access to PHI
18
CRM System
19
Identifying FDRs
• The Medicare Compliance Department conducts analysis of Medicare related vendors to determine FDR status
• Is the vendor providing administrative or healthcare services related to Medicare Part C or Part D Plans?
• Does the vendor have access to or work with member data?
• Risk assessment of size, potential impact to beneficiaries and risk for FWA.
Initial FDR Communication
Vendors:
• FDR status is recorded by Compliance in CRM system
• Compliance ensures a Regulatory Addendum was attached to the contract
• Disclosures of Ownership are collected; individuals and entities are checked against the OIG and GSA exclusion lists
• Standards of Conduct, General Compliance training and FWA training notification is sent to the vendor and notification is tracked in CRM system
Providers:
• Contractual obligation and provider welcome kit
21
Medica FWA Website for Vendors
22
Medica FWA Website for Providers
23
Annual FDR Oversight
• Send Standards of Conduct, General Compliance training and FWA training to FDRs
• Vendors notified through CRM system, letter, Medica’s vendor portal, and questionnaire
• Providers notified through Connections Article, letter, admin manual, provider portal
• Collect FDR attestation forms regarding compliance
• Attach scorecards to allow FDRs to provide greater detail on processes
• Identify deficiencies and determine corrective action plan for at-risk vendors
Key Considerations for Attestations
• Confirmation of FDR employee and board training
• Confirmation of downstream entity monitoring
• Attestation to policies and procedures regarding general compliance, FWA, anti-relation and prompt response to compliance issues
• Attestation to reporting mechanism for suspected FWA
• Validation of ongoing excluded entity checks
25
Auditing and Monitoring
Auditing FDRs
• Use annual attestations and scorecards to
identify potential non-compliance
• Identify high risk providers and vendors
Internal Auditing
• Conduct internal audit on FDR oversight
program to identify areas of improvement
• Conduct internal audit on CRM and business
unit compliance with contracting policies
26
Vendor Oversight Attestation
27
Vendor Oversight Scorecard
Medicare Vendor Compliance Program Scorecard
Vendor: Reporting Period: January 1- Dec 31, 2014
Business Area: Evaluation Date:
Overall Score:
Please complete the shaded sections of the scorecard using the drop-down boxes to the right of each question and the "Comments" box below each quesion.
I. Compliance Program Questions 1Do the policies and procedures cover major risk areas?
Instruction: Vendor will identify policies & procedures that address the major risk areas listed below.
Risk Policy or Procedure Title Last Revised
Health Risk Assessment Policy Care Plan Policy
Member Notification of Care Coordinator Contact Information Model of Care Training
2Are policies and procedures identified in question 1 available to business area staff?
Instruction: "Available" means the policies and procedures can be easily located in either electronic or hard copy format.
Comments:
3Is staff informed about Medicare requirements and any revisions or clarifications to the requirements prior to the effective date? Instruction: How did you inform staff about the requirements--by email, meeting, web-training, etc.
Comments:
4Does business area staff know how to report a Medicare compliance concern or suspected Fraud, Waste, or Abuse (including anonymous reporting)? Instruction: Please describe your reporting mechanisms in the comments section below.
Comments:
5Does business area know how to report/escalate a compliance concern to Medica? Instruction: Please briefly explain your process for reporting concerns to Medica.
Comments:
FDR Compliance Escalation Path
Compliance Vendor Oversight Manager and Committee
Corporate Compliance Officer
Executive Leadership and Board
29
Vendor Oversight Committee
• Provide guidance on scope of vendor oversight activities
• Assist in identifying FDRs
• Maintain list of FDRs, functions delegated and performance review activity
• Oversee auditing and monitoring results and corrective action
• Assist in non-compliance escalations
• Engage company-wide leadership
30
Final Insight
• Incorporate FDR considerations in all aspects of your Corporate Compliance Program
• Delegate and train key individuals in the business units
• Develop robust internal and external FDR policies and procedures, such as: Medicare and Corporate Compliance Work Plans, Overall Vendor Oversight Committee Workplan, FDR Decision Tree, FDR Attestation tracking, FDR Annual Workplan, Contracting Policies
• Create an annual work plan for FDR monitoring and auditing activities
• Conduct internal audits on your own processes for FDR oversight
• Engage leadership through the Oversight Committee
31
Resources
• Chapter 9, Medicare Prescription Drug Manual
• Chapter 11, Medicare Managed Care Manual
• Chapter 21, Medicare Managed Care Manual
• 42 CFR, Parts 422 and 423
